[go: up one dir, main page]

US9954897B2 - Methods and systems providing cyber security - Google Patents

Methods and systems providing cyber security Download PDF

Info

Publication number
US9954897B2
US9954897B2 US15/057,234 US201615057234A US9954897B2 US 9954897 B2 US9954897 B2 US 9954897B2 US 201615057234 A US201615057234 A US 201615057234A US 9954897 B2 US9954897 B2 US 9954897B2
Authority
US
United States
Prior art keywords
network
cyber
sensors
action
engine
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active, expires
Application number
US15/057,234
Other versions
US20170257396A1 (en
Inventor
Dan Shen
Genshe Chen
Khanh D. Pham
Erik Blasch
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Intelligent Fusion Technology Inc
Original Assignee
Intelligent Fusion Technology Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Intelligent Fusion Technology Inc filed Critical Intelligent Fusion Technology Inc
Priority to US15/057,234 priority Critical patent/US9954897B2/en
Assigned to Intelligent Fusion Technology, Inc reassignment Intelligent Fusion Technology, Inc ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: BLASCH, ERIK, PHAM, Khanh D., SHEN, DAN, CHEN, GENSHE
Publication of US20170257396A1 publication Critical patent/US20170257396A1/en
Assigned to Intelligent Fusion Technology, Inc. reassignment Intelligent Fusion Technology, Inc. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: BLASCH, ERIK, PHAM, Khanh D., SHEN, DAN, CHEN, GENSHE
Application granted granted Critical
Publication of US9954897B2 publication Critical patent/US9954897B2/en
Assigned to Intelligent Fusion Technology, Inc reassignment Intelligent Fusion Technology, Inc CORRECTIVE ASSIGNMENT TO CORRECT THE THE APPLICATION NUMBER PREVIOUSLY RECORDED AT REEL: 37911 FRAME: 389. ASSIGNOR(S) HEREBY CONFIRMS THE ASSIGNMENT. Assignors: BLASCH, ERIK, PHAM, Khanh D., SHEN, DAN, CHEN, GENSHE
Active legal-status Critical Current
Adjusted expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1491—Countermeasures against malicious traffic using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
    • G06N7/005—
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N7/00—Computing arrangements based on specific mathematical models
    • G06N7/01—Probabilistic graphical models, e.g. probabilistic networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic

Definitions

  • the present invention relates generally to the field of network security. More particularly, the present invention is related to methods for analysis of cyber network interactions among attackers, passive network sensors, and active network sensors using three-sided games, where each side can have multiple participants sharing the same goal.
  • the method provides network security based on the analysis.
  • Network attacks include one-to-one attacks, one-to-many attacks, and many-to-one attacks.
  • Existing network security methods suffer from high false positives, difficulty in detecting highly complex attacks, and the inability to adapt for detecting new types of attacks.
  • existing methods often perform attack identification in a passive manner by using only available alerts instead of actively seeking and prioritizing the most useful alerts to mitigate.
  • Another aspect that is lacking with current methods is the inability to provide effective mitigation of network threats, predicting future attacks, and resolving multiple simultaneous attacks.
  • the recommendation of mitigation is usually provided in an ad hoc and heuristic manner, often independent of the situation awareness (SA) process, the user, or the importance of the network for operational considerations.
  • SA situation awareness
  • a honeypot e.g., including active network sensors
  • a honeypot can act as a supportive side, which can be camouflaged in the network to help passive sensors detect and track cyber network attacks.
  • a system in accordance with an additional feature of the present invention, includes a computer programmed for three-side game-theoretic analysis of cyber network interactions among attackers, passive network sensors, and active network sensors.
  • a honeypot acts as a support side, which can be camouflaged in the network to help passive network sensors detect and track cyber network attacks, and which generally originate from attacking servers.
  • Game theory is relatively a new application for cyber research, and the use of a honey net provides a unique aspect of the work that enhances game-theoretic developments over passive network sensors and active network sensors.
  • the numerical game solution includes four features: first, it can quickly determine whether the game problem has one Nash equilibrium, multiple Nash equilibriums, or no Nash equilibrium; second, it can efficiently check if the equilibrium is a mixed or pure Nash; third, it can timely compute the (mixed) Nash equilibriums; and fourth, it also follows a Fictitious Play Concept.
  • FIG. 1 illustrates a block diagram of a system in accordance with features of the present invention
  • FIG. 2 is a concept level block diagram of the three-sided game model for cyber network security problems
  • FIG. 3 depicts the system level flowchart of the three-sided game model and the geometric method
  • FIG. 4 depicts an exemplary three sided game in a matrix format
  • FIG. 5 is an exemplary action curve and surface intersection which has pure active sensor strategy
  • FIG. 6 depicts another exemplary action curve and surface intersection which is a typical mixed Nash equilibrium
  • FIG. 7 is a flowchart showing the block 33 , “determine a cell and line segment”, of FIG. 3 .
  • FIG. 8 depicts an exemplary cell and line segment to be searched for the intersection of action surface (of attacker) and action curve (defender).
  • FIG. 9 is a flowchart showing the main process of “current set contains MNE?” route 71 in FIG. 7 .
  • FIG. 10 is a flowchart showing the “is p insider a triangle (p1, p2, p3)?” route 93 in FIG. 9 .
  • FIG. 11 depicts an exemplary cell and line segment containing the intersection of action surface (of attacker) and action curve (defender).
  • the purpose of this invention is to develop three-sided game theory based innovative situation awareness systems and methods for active network security and impact mitigation of adversarial attacks against cyber networks.
  • FIG. 1 there is shown an implementation of a cyber-network security system according to the invention in a local network having the passive and active network sensors deployed.
  • the local network comprises N production server 14 .sub. 1 to 14 .sub.N.
  • the network traffic can be monitored by a Snort based passive network sensor (PNS) 12 a , which can be controlled by the PNS engine 12 b .
  • PNS Snort based passive network sensor
  • Some network requests can be routed to an active network sensor (ANS) 13 b , which can interact with remote users in a virtual way.
  • the ANS can be deployed based on Honeypot and Address Resolution Protocol Daemon (ARPD).
  • the interaction scripts and strategies can be reconfigured via the ANS engine 13 b .
  • the attacker 10 can launch cyber-attacks to the local network via the Internet 11 .
  • the PNS engine and ANS engine can follow the mixed Nash equilibrium of the three-side game model shown in FIG. 2 .
  • FIG. 2 shows the concept level framework of the three-side game model.
  • Attacker 2 may launch various cyber-attack weapons 21 a , which are inputs to the game model. Attacks will get rewards 21 b , which depend on the game model parameters 23 , PNS strategies 25 a , and ANS strategies 26 a . Similarly, PNS engine 27 and ANS engine 28 can obtain their rewards 25 b and 26 b respectively. Their values are also partially determined by the attacker's choices. This reward dependence is the main modeling merit of game theory method: decisions should be made with the consideration of the opponents.
  • MNE Mixed Nash equilibrium
  • the action surface or action curve is set of one side's best response actions for his opponents' possible choices.
  • the ANS and PNS are coordinated to defend attackers. Therefore, given a combined PNS and ANS choices (h k , s k ), the attacker will compute his best response r k . Since h k , s k and r k are all scalar values, the attacker's best response set is a surface, which is called an action surface. Similarly, for ANS and PNS, their combined best response is a curve, called an action curve.
  • FIG. 3 shows the system level flowchart of the invention.
  • Block 30 creates a three-sided game model based on a scenario or problem.
  • the system states are defined as the probability vector of N servers: ( p 1 1
  • 1 is the detection rate (DR), which is the probability that server i is flagged as attacked when it is actually attacked
  • 0 is the false positive rate (FPR), which is the probability that server i is flagged as attacked when it is actually NOT attacked.
  • DR detection rate
  • FPR false positive rate
  • p i f is the probability that an attack on server i is failed and
  • p i f p i 1
  • the three-sided interaction is modeled as a matrix game.
  • FIG. 4 depicts an exemplary three-sided game in a matrix format.
  • the game size (shown by 40 ) is determined by the possible strategies of the three sides. After all sides choose their strategies, a special three-dimensional (3D) action curve or cube can be picked.
  • the game in FIG. 4 is played by three sides in such a way that attacker chooses his strategy to maximize the J a (eq. 3) in the picked cube (for example cube 41 in FIG. 4 ), while PNS and ANS engines choose their coordinated strategies to maximize the J d (eq. 2) in the same cube, which depends on both attacker's and PNS/ANS combined engine choices.
  • J a eq. 3
  • PNS and ANS engines choose their coordinated strategies to maximize the J d (eq. 2) in the same cube, which depends on both attacker's and PNS/ANS combined engine choices.
  • this invention presents a geometric solution to compute MNEs.
  • the action curve (surface) based solution is depicted in block 31 - 34 of FIG. 3 .
  • Block 31 computes the action curve of PNS and ANS engines. For all possible attacker strategies, eq. (2) is maximized by choosing the coordinated PNS and ANS strategies. By connecting all these best responses of coordinated strategies, along with the chosen attacker strategies, block 31 obtains the defender action curve.
  • Block 32 computes the action surface of attacker. For any possible coordinated PNS and ANS strategies, eq. (3) is maximized by choosing the attacker strategy. Then block 32 connects these best responses of attacking strategies, along with the chosen coordinated defender strategies, to obtain the attacker action surface.
  • MNE mixed Nash equilibrium
  • FIG. 5 is an exemplary action curve and surface intersection which has a pure active sensor strategy.
  • 51 00 is the point at attacker action surface when ANS and PNS engines choose the coordinated strategy (0, 0).
  • 51 a2 is the point at attacker action surface when ANS and PNS engines choose the coordinated strategy (10, 2).
  • 50 7 is the point at the defender action curve when attacker takes no. 7 strategy.
  • 50 5 is the point at the defender action curve when attacker takes no. 5 strategy.
  • 52 5 and 52 a are the contour lines of the attacker action surface when the attacking rate is 50% and 100% of the maximum attacking speed. From the plot in FIG. 5 , it is obvious that PNS engine will play his No. 10 strategy and the intersection occurs between 50 4 and 50 5 at the action curve.
  • FIG. 6 depicts another exemplary action curve and action surface intersection which is a typical mixed Nash equilibrium.
  • 60 9 is the point at the defender action curve when attacker takes no. 9 strategy.
  • 60 8 is the point at the defender action curve when attacker takes no. 8 strategy.
  • 61 27 is the point at attacker action surface when ANS and PNS engines choose the coordinated strategy (2, 7).
  • 61 19 is the point at attacker action surface when ANS and PNS engines choose the coordinated strategy (1, 9).
  • 62 23 and 62 7 are the contour lines of the attacker action surface when the attacking rate is 30% and 70% of the maximum attacking speed. From the plot in FIG. 8 , it is difficult to find location of the intersection. Therefore, the invention presents a geometric solution ( FIG. 7 ) to find cells in action surface and the related line segments in action curve so that they contains the intersection points.
  • FIG. 7 is a flowchart showing the “determine a cell and line segment” block 33 in the process of FIG. 3 .
  • Block 70 is to initialize the searching by setting the sizes of the attacker action set, the PNS action set, and the ANS action set. It also set the initial position of the searching.
  • Block 71 is to test whether current action surface cell and action curve segment contain the intersection. The details of this block are described in FIG. 8 .
  • Block 72 saves the current decision set if it contains the intersection. Otherwise, the process will search next set (surface cell and curve segment). This decision can be decomposed in Block 73 - 77 .
  • Block 73 will check whether all the surface cells are searched. If yes, it is ready to test the possible intersection between next curve segment and one of the all surface cells.
  • Block 76 will check whether all curve segments searched. If yes, the search processing ends and exits (block 78 ). If no, the next curve segment is set in block 77 . Then it will repeat the search by going to block 71 . Another possible outcome of block 73 is that unsearched cells for current curve segment may exist. Therefore, the next surface cell is set as the current cell in block 75 . The test procedure repeats and goes to block 71 . After all sets are searched, the process will exit (Block 78 ) with saved sets containing the intersection points, which are MNEs. The invention will further calculate the MNEs in Block 34 of FIG. 3 .
  • FIG. 8 depicts an exemplary cell and line segment to be searched for the intersection of action surface (of attacker) and action curve (defender).
  • 80 1 - 80 4 determine the action surface cell projected to ANS and PNS engines strategy space (like 43 in FIG. 4 ).
  • 81 1 and 81 2 define the action curve segment, where r 1 and r 2 are the consecutive attacker strategies. Since all 6 points are on the action surface or action curve, the locations in three-dimensional (3D) spaces can be determined. This problem, of whether the set contains an intersection point, can be solved via the following way:
  • FIG. 9 is a flow chart of testing whether a line segment goes through a triangle. This part is the main process of “current set contains MNE?” route 71 in FIG. 7 .
  • Block 90 specifies the input and output structure. The inputs are the three points of the triangle and the line segment. The output is yes or no.
  • Block 91 calculates the intersection point of the plane, which contains the triangle, and the line, which contains the line segment. The detail algorithm is listed as follows:
  • FIG. 10 is a flow chart showing the “is P insider a triangle (p1, p2, p3)?” route 93 in FIG. 9 .
  • Block 100 is to specify the input structure, which contains the three points of the triangle and a point to be tested. Given that the p and triangle are in the same plane (since p is the intersection point, p is in the plane contains the triangle), the geometric solution is based on following observation. A point p is the triangle (p 1 ,p 2 ,p 3 ), if and only if
  • the next step is to compute the MNE for a given action surface cell and action curve segment, which contains the intersection point.
  • FIG. 11 depicts an exemplary cell and line segment containing the intersection of action surface (of attacker) and action curve (defender). Points 110 1 - 110 4 define the cell and point 111 is the intersection point. The exact position (in three dimensions: PNS s* , ANS h*, and Attacker r*, see FIG.
  • s* ⁇ 1 s 1 + ⁇ 2 s 2 + ⁇ 3 s 3 +(1 ⁇ 1 ⁇ 2 ⁇ 3 ) s 4 (4)
  • h* ⁇ 1 h 1 + ⁇ 2 h 2 + ⁇ 3 h 3 +(1 ⁇ 1 ⁇ 2 ⁇ 3 ) h 4
  • r* ⁇ 1 r 1 +(1 ⁇ 1 ) r 2 (6) where 0 ⁇ 1 ⁇ 1, 0 ⁇ ( ⁇ 1 + ⁇ 2 + ⁇ 3 ) ⁇ 1, and 0 ⁇ 1 ⁇ 1.
  • r 1 and r 2 are the attacking strategies of the two end points of active curvve segment.
  • Block 35 of FIG. 3 is implemented the obtain MNE.
  • the PNS engine will play s 1 strategy with probability ⁇ 1 , s 2 strategy with probability ⁇ 2 , s 3 strategy with probability ⁇ 3 , and s4 strategy with probability 1- ⁇ 1 - ⁇ 2 - ⁇ 3 .
  • the ANS engine will play h 1 strategy with probability ⁇ 1 , h 2 strategy with probability ⁇ 2 , h 3 strategy with probability ⁇ 3 , and h4 strategy with probability 1- ⁇ 1 - ⁇ 2 - ⁇ 3 .
  • the attacker will play the r 1 strategy with probability ⁇ 1 , and the r 2 strategy with probability 1- ⁇ 1 .
  • Block 36 and 37 of FIG. 3 are designed to let system update the states defined in eq. (1). Then the game can be updated with the new system states. Accordingly, the three-sided game solution can be calculated using the geometric solution of the present invention, which provides a closed loop control paradigm.
  • geometry is a branch of mathematics concerned with questions of shape, size, relative position of figures, and the properties of space.
  • the disclosed geometric solution solves the three-sided game model by finding a three-dimensional action curve (e.g. for a cyber defender) and a three-dimensional action surface (e.g. for a cyber attacker).
  • the action surface or action curve is set of one side's best responses actions for all the opponents' possible choices of actions.
  • the ANS and PNS engines are coordinated to defend against attackers. Therefore, given a combined PNS and NAS engine choices (a two-dimensional point), the attacker computes his best response. All the attacker's best responses form a surface, which is called an action surface. This set is described in block 32 of FIG. 3 .
  • the first step is to find a cell containing the point, as described in block 33 of FIG. 3 .
  • the second step is to locate the intersection point in the cell, as described in block 23 of FIG. 3 . Since the three-sided game solution is based on the geometric relation (intersection) of two shapes (action curve and action surface), the solution is called geometric solution in this disclosure.
  • the present numerical game solution has four features: first, it can quickly determine whether the game problem has one Nash equilibrium, multiple Nash equilibriums, or no Nash equilibrium; second, it can efficiently check the equilibrium is a mixed or pure Nash; third, it can timely compute the (mixed) Nash equilibriums; and fourth, it also follows a Fictitious play concept, from which the solution is an adaptive one and can be applied for any partially observed cyber security system.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Artificial Intelligence (AREA)
  • Computational Mathematics (AREA)
  • Data Mining & Analysis (AREA)
  • Evolutionary Computation (AREA)
  • Algebra (AREA)
  • Mathematical Analysis (AREA)
  • Mathematical Optimization (AREA)
  • Pure & Applied Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Software Systems (AREA)
  • Probability & Statistics with Applications (AREA)
  • Computer And Data Communications (AREA)

Abstract

Methods and systems for providing cyber security, wherein a computer with network access incorporates game theory and utilizes a honeypot to enhance game-theoretic developments over active and passive sensors. To numerically solve the uniquely three-sided game modeled cyber security problem, using a geometric solution based on three-dimensional (3D) action surface and action curve. The methods and systems determine whether the game problem has one Nash equilibrium, multiple Nash equilibriums, or no Nash equilibrium; checks whether the equilibrium is a mixed or pure Nash; and timely computes Nash equilibriums; and follows a fictitious play concept. The solution is adaptive and can be applied for any partially observed cyber security system.

Description

STATEMENT OF GOVERNMENT INTEREST
This invention was made with Government support under Contract No. FA9453-14-C-0016, awarded by the United States Air Force. The U.S. Government has certain rights in this invention.
FIELD OF THE INVENTION
The present invention relates generally to the field of network security. More particularly, the present invention is related to methods for analysis of cyber network interactions among attackers, passive network sensors, and active network sensors using three-sided games, where each side can have multiple participants sharing the same goal. The method provides network security based on the analysis.
BACKGROUND
Network attacks include one-to-one attacks, one-to-many attacks, and many-to-one attacks. Existing network security methods suffer from high false positives, difficulty in detecting highly complex attacks, and the inability to adapt for detecting new types of attacks. Moreover, existing methods often perform attack identification in a passive manner by using only available alerts instead of actively seeking and prioritizing the most useful alerts to mitigate. Another aspect that is lacking with current methods is the inability to provide effective mitigation of network threats, predicting future attacks, and resolving multiple simultaneous attacks. For current methods, the recommendation of mitigation is usually provided in an ad hoc and heuristic manner, often independent of the situation awareness (SA) process, the user, or the importance of the network for operational considerations.
SUMMARY OF THE EMBODIMENTS
It is a feature of the present invention to provide network security in the form of three-sided game-theoretic analysis of the cyber network interactions among attackers, passive network sensors, and active network sensors. A honeypot (e.g., including active network sensors) can act as a supportive side, which can be camouflaged in the network to help passive sensors detect and track cyber network attacks.
In accordance with an additional feature of the present invention, a system is provided that includes a computer programmed for three-side game-theoretic analysis of cyber network interactions among attackers, passive network sensors, and active network sensors. A honeypot acts as a support side, which can be camouflaged in the network to help passive network sensors detect and track cyber network attacks, and which generally originate from attacking servers. Game theory is relatively a new application for cyber research, and the use of a honey net provides a unique aspect of the work that enhances game-theoretic developments over passive network sensors and active network sensors.
It is yet another feature of the present invention to utilize a geometric solution based on a three-dimensional action curve (for a cyber defender) and a three-dimensional action surface (for a cyber attacker) to numerically solve the uniquely three-side game modeled cyber security problem. The numerical game solution includes four features: first, it can quickly determine whether the game problem has one Nash equilibrium, multiple Nash equilibriums, or no Nash equilibrium; second, it can efficiently check if the equilibrium is a mixed or pure Nash; third, it can timely compute the (mixed) Nash equilibriums; and fourth, it also follows a Fictitious Play Concept. These four features provide an adaptive solution and can be applied in any partially observed cyber security system.
BRIEF DESCRIPTION OF THE DRAWINGS
FIG. 1 illustrates a block diagram of a system in accordance with features of the present invention;
FIG. 2 is a concept level block diagram of the three-sided game model for cyber network security problems;
FIG. 3 depicts the system level flowchart of the three-sided game model and the geometric method;
FIG. 4 depicts an exemplary three sided game in a matrix format;
FIG. 5 is an exemplary action curve and surface intersection which has pure active sensor strategy;
FIG. 6 depicts another exemplary action curve and surface intersection which is a typical mixed Nash equilibrium;
FIG. 7 is a flowchart showing the block 33, “determine a cell and line segment”, of FIG. 3.
FIG. 8 depicts an exemplary cell and line segment to be searched for the intersection of action surface (of attacker) and action curve (defender).
FIG. 9 is a flowchart showing the main process of “current set contains MNE?” route 71 in FIG. 7.
FIG. 10 is a flowchart showing the “is p insider a triangle (p1, p2, p3)?” route 93 in FIG. 9.
FIG. 11 depicts an exemplary cell and line segment containing the intersection of action surface (of attacker) and action curve (defender).
 DETAILED DESCRIPTION OF EMBODIMENTS
The purpose of this invention is to develop three-sided game theory based innovative situation awareness systems and methods for active network security and impact mitigation of adversarial attacks against cyber networks.
Referring to FIG. 1, there is shown an implementation of a cyber-network security system according to the invention in a local network having the passive and active network sensors deployed. The local network comprises N production server 14.sub.1 to 14.sub.N. The network traffic can be monitored by a Snort based passive network sensor (PNS) 12 a, which can be controlled by the PNS engine 12 b. Some network requests can be routed to an active network sensor (ANS) 13 b, which can interact with remote users in a virtual way. The ANS can be deployed based on Honeypot and Address Resolution Protocol Daemon (ARPD). The interaction scripts and strategies can be reconfigured via the ANS engine 13 b. The attacker 10 can launch cyber-attacks to the local network via the Internet 11. The PNS engine and ANS engine can follow the mixed Nash equilibrium of the three-side game model shown in FIG. 2.
FIG. 2 shows the concept level framework of the three-side game model. Attacker 2 may launch various cyber-attack weapons 21 a, which are inputs to the game model. Attacks will get rewards 21 b, which depend on the game model parameters 23, PNS strategies 25 a, and ANS strategies 26 a. Similarly, PNS engine 27 and ANS engine 28 can obtain their rewards 25 b and 26 b respectively. Their values are also partially determined by the attacker's choices. This reward dependence is the main modeling merit of game theory method: decisions should be made with the consideration of the opponents. To obtain the game solution of Mixed Nash equilibrium (MNE), the invention presents a geometric solution 24 to determine and calculate the intersection point of attacker's action surface and defender's action curve. The action surface or action curve is set of one side's best response actions for his opponents' possible choices. In the three cyber game model, the ANS and PNS are coordinated to defend attackers. Therefore, given a combined PNS and ANS choices (hk, sk), the attacker will compute his best response rk. Since hk, sk and rk are all scalar values, the attacker's best response set is a surface, which is called an action surface. Similarly, for ANS and PNS, their combined best response is a curve, called an action curve.
FIG. 3 shows the system level flowchart of the invention. Block 30 creates a three-sided game model based on a scenario or problem. For the general scenario in FIG. 1, the system states are defined as the probability vector of N servers:
(p 1 1|1 ,p 1 1|0 ,p 2 1|1 ,p 2 1|0 , . . . p N 1|1 ,p N 1|0)  (1)
where pi 1|1 is the detection rate (DR), which is the probability that server i is flagged as attacked when it is actually attacked, pi 1|0 is the false positive rate (FPR), which is the probability that server i is flagged as attacked when it is actually NOT attacked.
Given the system state vector p=(p1 1|1, p1 1|0, p2 1|1, p2 1|0, . . . )′, the reward functions for the attacker and defender are defined as
J d(p)=Σi=1:N(c i1 p i 1|1 −c i2 p i 0|1 −c i3 p i 1|0)  (2)
J a(p)=Σi=1:N(v i1 p i s −v i2 p i t)  (3)
where ci1, ci2, ci3 are the positive constants for server i; pi 0|1=1−pi 1|1 is the miss detection probability; vi1, vi2 are the value of server i and the cost of attacking server i; pi s is the probability of successfully penetrate server i. The model includes pi s=pi 0|1pa(j), where pa(j) is the success rate of the selected attack (j). pi f is the probability that an attack on server i is failed and pi f=pi 1|1+pi 0|1(1−pa(j)). The three-sided interaction is modeled as a matrix game. FIG. 4 depicts an exemplary three-sided game in a matrix format. The game size (shown by 40) is determined by the possible strategies of the three sides. After all sides choose their strategies, a special three-dimensional (3D) action curve or cube can be picked. For example, if attacker chooses r3, ANS engine chooses h3, and PNS engine chooses s3, then cube 41 is picked. Square 43 is the coordinated strategy of PNS and ANS. Square 42 tells the chosen attacker strategy. In the cube 41, there are two values obtained from equation (2) and (3), respectively.
The game in FIG. 4 is played by three sides in such a way that attacker chooses his strategy to maximize the Ja (eq. 3) in the picked cube (for example cube 41 in FIG. 4), while PNS and ANS engines choose their coordinated strategies to maximize the Jd (eq. 2) in the same cube, which depends on both attacker's and PNS/ANS combined engine choices.
To solve the three-sided game problem, this invention presents a geometric solution to compute MNEs. The action curve (surface) based solution is depicted in block 31-34 of FIG. 3. Block 31 computes the action curve of PNS and ANS engines. For all possible attacker strategies, eq. (2) is maximized by choosing the coordinated PNS and ANS strategies. By connecting all these best responses of coordinated strategies, along with the chosen attacker strategies, block 31 obtains the defender action curve.
Block 32 computes the action surface of attacker. For any possible coordinated PNS and ANS strategies, eq. (3) is maximized by choosing the attacker strategy. Then block 32 connects these best responses of attacking strategies, along with the chosen coordinated defender strategies, to obtain the attacker action surface.
For the three-sided game, an intersection of action curve and surface is a Nash strategy. If the intersection located exactly on these best response points, then the Nash strategy is a pure Nash equilibrium (PNE). Otherwise it is a mixed Nash equilibrium (MNE). PNE can be seemed a special case of MNE, so in this invention, MNEs can be used to solve the three-sided game model. Another advantage of MNE is that at least one MNE always exists for the three-sided game model for cyber network security.
FIG. 5 is an exemplary action curve and surface intersection which has a pure active sensor strategy. 51 00 is the point at attacker action surface when ANS and PNS engines choose the coordinated strategy (0, 0). 51 a2 is the point at attacker action surface when ANS and PNS engines choose the coordinated strategy (10, 2). 50 7 is the point at the defender action curve when attacker takes no. 7 strategy. 50 5 is the point at the defender action curve when attacker takes no. 5 strategy. 52 5 and 52 a are the contour lines of the attacker action surface when the attacking rate is 50% and 100% of the maximum attacking speed. From the plot in FIG. 5, it is obvious that PNS engine will play his No. 10 strategy and the intersection occurs between 50 4 and 50 5 at the action curve.
FIG. 6 depicts another exemplary action curve and action surface intersection which is a typical mixed Nash equilibrium. 60 9 is the point at the defender action curve when attacker takes no. 9 strategy. 60 8 is the point at the defender action curve when attacker takes no. 8 strategy. 61 27 is the point at attacker action surface when ANS and PNS engines choose the coordinated strategy (2, 7). 61 19 is the point at attacker action surface when ANS and PNS engines choose the coordinated strategy (1, 9). 62 23 and 62 7 are the contour lines of the attacker action surface when the attacking rate is 30% and 70% of the maximum attacking speed. From the plot in FIG. 8, it is difficult to find location of the intersection. Therefore, the invention presents a geometric solution (FIG. 7) to find cells in action surface and the related line segments in action curve so that they contains the intersection points.
FIG. 7 is a flowchart showing the “determine a cell and line segment” block 33 in the process of FIG. 3. Block 70 is to initialize the searching by setting the sizes of the attacker action set, the PNS action set, and the ANS action set. It also set the initial position of the searching. Block 71 is to test whether current action surface cell and action curve segment contain the intersection. The details of this block are described in FIG. 8. Block 72 saves the current decision set if it contains the intersection. Otherwise, the process will search next set (surface cell and curve segment). This decision can be decomposed in Block 73-77. Block 73 will check whether all the surface cells are searched. If yes, it is ready to test the possible intersection between next curve segment and one of the all surface cells. The test will start from first curve segment as set in block 74. Block 76 will check whether all curve segments searched. If yes, the search processing ends and exits (block 78). If no, the next curve segment is set in block 77. Then it will repeat the search by going to block 71. Another possible outcome of block 73 is that unsearched cells for current curve segment may exist. Therefore, the next surface cell is set as the current cell in block 75. The test procedure repeats and goes to block 71. After all sets are searched, the process will exit (Block 78) with saved sets containing the intersection points, which are MNEs. The invention will further calculate the MNEs in Block 34 of FIG. 3.
FIG. 8 depicts an exemplary cell and line segment to be searched for the intersection of action surface (of attacker) and action curve (defender). 80 1-80 4 determine the action surface cell projected to ANS and PNS engines strategy space (like 43 in FIG. 4). 81 1 and 81 2 define the action curve segment, where r1 and r2 are the consecutive attacker strategies. Since all 6 points are on the action surface or action curve, the locations in three-dimensional (3D) spaces can be determined. This problem, of whether the set contains an intersection point, can be solved via the following way:
    • if r1r2 go through Δ123, true, exit;
    • else if r1r2 go through Δ124, true, exit;
    • else if r1r2 go through Δ134, true, exit;
    • else r1r2 go through Δ234, true, else false;
      where Δ123 is the triangle determined by points 80 1, 80 2, and 80 3. Similar notes for Δ124, Δ134, and Δ234, The geometric solution to test whether a line segment go through a triangle is presented in FIG. 9.
FIG. 9 is a flow chart of testing whether a line segment goes through a triangle. This part is the main process of “current set contains MNE?” route 71 in FIG. 7. Block 90 specifies the input and output structure. The inputs are the three points of the triangle and the line segment. The output is yes or no. Block 91 calculates the intersection point of the plane, which contains the triangle, and the line, which contains the line segment. The detail algorithm is listed as follows:
    • n=cross((p2−p1), (p3−p1)); % calculate the normal vector
    • if (n′*(pt−ps)==0), return false; % no intersection
    • r=n′*(p1−ps)/(n′*(pt−ps)); % calculate the ratio on the normal vector
    • p=ps+r*(pt−ps); % calculate the intersection point based on the ratio
      Note that the intersection may not be located in the triangle or in the line segment even if the intersection point exists. Therefore, blocks 92-95 are used here to further test whether the intersection point is in the triangle AND in the line segment. Block 92 checks if the intersection point p is between ps and pt. If no, triangle (p1, p2, p3) doesn't intersect with the line segment (ps, pt) as stated in Block 95. Otherwise, the Block 93 is used to test whether the intersection point p is inside the triangle (p1, p2, p3). The details of the block 93 will be explained in the following FIG. 10. If the result of Block 93 is yes, triangle (p1, p2, p3) does intersect with the line segment (ps, pt) as stated in Block 94. Otherwise, the procedure goes to Block 95.
FIG. 10 is a flow chart showing the “is P insider a triangle (p1, p2, p3)?” route 93 in FIG. 9, Block 100 is to specify the input structure, which contains the three points of the triangle and a point to be tested. Given that the p and triangle are in the same plane (since p is the intersection point, p is in the plane contains the triangle), the geometric solution is based on following observation. A point p is the triangle (p1,p2,p3), if and only if
    • p and p1 on the same side of the line through p2 and p3, AND
    • p and p2 on the same side of the line through p1 and p3, AND
    • p and p3 on the same side of the line through p1 and p2.
      The invention uses the following geometric method to test where two points (p1, and p) on the same side of a line (p2, p3):
    • cp1=cross(p2−p3, p−p3); % calculate the cross product
    • cp2=cross(p2−p3, p1−p3); % calculate the cross product
    • IF cp1′*cp2>=0, same side. ELSE different side.
      Blocks 101-106 depict the whole test processing of whether p insider a triangle (p1, p2, p3). Block 101 tests whether p and p1 are on the same side of line (p2, p3). If yes, the procedure continues in Block 102. Otherwise, p is not in the current triangle as stated in Block 105. Block 102 tests whether p and p2 are on the same side of line (p1, p3). If yes, the procedure continues in Block 103. Otherwise, p is not in the current triangle as stated in Block 105. Block 103 tests whether p and p3 are on the same side of line (p1, p2). If yes, p is in the current triangle as stated in Block 104. Otherwise, p is not in the current triangle as stated in Block 105. The procedure exits in Block 106.
The next step (block 34 of FIG. 3) is to compute the MNE for a given action surface cell and action curve segment, which contains the intersection point. FIG. 11 depicts an exemplary cell and line segment containing the intersection of action surface (of attacker) and action curve (defender). Points 110 1-110 4 define the cell and point 111 is the intersection point. The exact position (in three dimensions: PNS s* , ANS h*, and Attacker r*, see FIG. 4 for visual illustration) of 111 can be formulated as
s*=λ 1 s 1+λ2 s 2+λ3 s 3+(1−λ1−λ2−λ3)s 4  (4)
h*=λ 1 h 1+λ2 h 2+λ3 h 3+(1−λ1−λ2−λ3)h 4  (5)
r*=κ 1 r 1+(1−κ1)r 2  (6)
where 0≦λ1≦1, 0≦(λ1+λ2+λ3)≦1, and 0≦κ1≦1. r1 and r2 are the attacking strategies of the two end points of active curvve segment. Then the rewards, J, are
J* d =J d(s*,h*,r*)=f d(λ1,λ2,λ3,κ1)  (7)
J* a =J a(s*,h*,r*)=f a(λ1,λ2,λ3,κ1)  (8)
Since (s*, h*, r*) is a mixed Nash equilibrium, the following equations apply:
∂f d/∂λ1=0  (9)
∂f d/∂λ2=0  (10)
∂f d/∂λ3=0  (11)
∂f a/∂κ1=0  (12)
where λ1, λ2, λ3, and κ1 can be obtained by solving the equations (9-12). Then the MNE can be computed by eq. 4-6.
Block 35 of FIG. 3 is implemented the obtain MNE. For the defender side, the PNS engine will play s1 strategy with probability λ1, s2 strategy with probability λ2, s3 strategy with probability λ3, and s4 strategy with probability 1-λ1-λ2-λ3. The ANS engine will play h1 strategy with probability λ1, h2 strategy with probability λ2, h3 strategy with probability λ3, and h4 strategy with probability 1-λ1-λ2-λ3. Similarly, for the attacker side, the attacker will play the r1 strategy with probability κ1, and the r2 strategy with probability 1-κ1. To implement the MNE, two uniformly distributed random variables over [0, 1], Xd for defender and Xa for attacker, will be created. Each time, the random values will be used to determine which pure strategy to use. If Xd∈[0, λ1], then PNS engine takes s1 and ANS engine takes h1. If Xd∈(λ1, λ1+λ2 9 , PNS engine takes s2 and ANS engine takes h2. If Xd∈(λ1+λ2, λ1+λ2+λ3], PNS engine takes s3 and ANS engine takes h3. If Xd∈(λ1+λ2+λ3, 1], PNS engine takes s4 and ANS engine takes h4. Similar, if Xa∈[0, κ1], the attacker will apply the r1 strategy. If Xa∈[κ1, 1], the attacker will apply the r2 strategy.
Block 36 and 37 of FIG. 3 are designed to let system update the states defined in eq. (1). Then the game can be updated with the new system states. Accordingly, the three-sided game solution can be calculated using the geometric solution of the present invention, which provides a closed loop control paradigm.
In general, geometry is a branch of mathematics concerned with questions of shape, size, relative position of figures, and the properties of space. The disclosed geometric solution solves the three-sided game model by finding a three-dimensional action curve (e.g. for a cyber defender) and a three-dimensional action surface (e.g. for a cyber attacker). The action surface or action curve is set of one side's best responses actions for all the opponents' possible choices of actions. In the three-sided game model, the ANS and PNS engines are coordinated to defend against attackers. Therefore, given a combined PNS and NAS engine choices (a two-dimensional point), the attacker computes his best response. All the attacker's best responses form a surface, which is called an action surface. This set is described in block 32 of FIG. 3. Similarly, for ANS and PNS engines, their combined best response is a curve, called an action curve, which is described in block 31 of FIG. 3. To find the intersection point between the action curve and the action surface, the first step is to find a cell containing the point, as described in block 33 of FIG. 3. The second step is to locate the intersection point in the cell, as described in block 23 of FIG. 3. Since the three-sided game solution is based on the geometric relation (intersection) of two shapes (action curve and action surface), the solution is called geometric solution in this disclosure.
For cyber applications, game theory is a relatively new concept and the use of a honeypot is a unique aspect of the work that enhances game-theoretic developments over active and passive sensors. To numerically solve the uniquely three-side game modeled cyber security problem, a geometric solution based on action surface and action curve is developed. To summarize, the present numerical game solution has four features: first, it can quickly determine whether the game problem has one Nash equilibrium, multiple Nash equilibriums, or no Nash equilibrium; second, it can efficiently check the equilibrium is a mixed or pure Nash; third, it can timely compute the (mixed) Nash equilibriums; and fourth, it also follows a Fictitious play concept, from which the solution is an adaptive one and can be applied for any partially observed cyber security system.

Claims (4)

The invention claimed is:
1. A cyber security system, comprising:
network servers, passive network sensors, and active network sensors in a cyber network;
a computer with data network access and programmed for a three-sided game-theoretic analysis of interactions among cyber attackers, the passive network sensors, and the active network sensors,
wherein the network servers are targets of the cyber attackers;
wherein the passive network sensors and the active network sensors are defenders;
wherein the passive network sensors are a Snort-based Passive Network Sensor (PNS) and the active network sensors are a Honeypot based Active Network Sensor (ANS);
wherein the passive network sensors are controlled by PNS engine and the active network sensors are controlled by ANS engine, wherein the PNS engine and ANS engine are coordinated to defend against the cyber attackers and are reconfigured by implementing a mixed Nash equilibrium of the three-sided game-theoretic analysis;
the honeypot, including the active network sensors, acting as an active side and camouflaged in the data network to help passive network sensors detect and track cyber network attacks originated from the cyber attackers; and
wherein the passive network sensors monitor data network traffic and interacting with the honeypot, wherein the PNS engine choice (sk), and the ANS engine choice (hk) are combined and coordinated to defend against the cyber attackers computed best response (rk), wherein: k>=1;
hk, sk and rk are all scalar values;
a set of rk of the cyber attackers are used to determine an action surface, and a set of sk and hk are combined and coordinated to obtain an action curve; and
an intersection point of the action surface and the action curve are calculated according to a geometric solution, wherein the intersection point of the action surface and the action curve is used to calculate a solution of the mixed Nash equilibrium of the three-sided game theoretic analysis to provide a closed loop control paradigm.
2. The cyber security system of claim 1, wherein the action curve includes a three-dimensional action curve and a three-dimensional action surface the three-sided game-theoretic analysis utilizes three-dimensional action curve and a three-dimensional action surface to analyze and numerically solve three-sided game modeled cyber security problems.
3. A method for providing cyber security, comprising:
providing network servers, passive network sensors, and active network sensors in a cyber network; and
providing at least one computer with data network access and programmed for a three-sided game-theoretic analysis of interactions among cyber attackers, the passive network sensors, and the active network sensors,
wherein the network servers are targets of the cyber attackers;
wherein the passive network sensors and the active network sensors are defenders;
wherein the passive network sensors are a snort-based passive network sensor (PNS) and the active network sensors are a honeypot based active network sensor (ANS);
wherein the passive network sensors are controlled by PNS engine and the active network sensors are controlled by ANS engine, wherein the PNS engine and ANS engine are coordinated to defend against the cyber attackers and are reconfigured by implementing a mixed Nash equilibrium of the three-sided game-theoretic analysis;
the honeypot, including the active network sensors, acting as an active side and camouflaged in the data network to help passive network sensors detect and track cyber network attacks originated from the network servers; and
wherein the passive network sensors monitor data network traffic and interacting with the honeypot, wherein the PNS engine choice (sk), and the ANS engine choice (hk) are combined and coordinated to defend against the cyber attackers computed best response (rk), wherein: k>=1;
hk, sk and rk are all scalar values;
a set of rk of the cyber attackers are used to determine an action surface, and a set of sk and hk are combined and coordinated to obtain an action curve; and
an intersection point of the action surface and the action curve are calculated according to a geometric solution, wherein the intersection point of the action surface and the action curve is used to calculate a solution of the mixed Nash equilibrium of the three-sided game theoretic analysis to provide a closed loop control paradigm.
4. The method for providing cyber security of claim 3, wherein the action curve includes a three-dimensional action curve and a three-dimensional action surface the three-sided game-theoretic analysis utilizes three-dimensional action curve and a three-dimensional action surface to numerically analyze and solve three-sided game modeled cyber security problems.
US15/057,234 2016-03-01 2016-03-01 Methods and systems providing cyber security Active 2036-06-25 US9954897B2 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/057,234 US9954897B2 (en) 2016-03-01 2016-03-01 Methods and systems providing cyber security

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
US15/057,234 US9954897B2 (en) 2016-03-01 2016-03-01 Methods and systems providing cyber security

Publications (2)

Publication Number Publication Date
US20170257396A1 US20170257396A1 (en) 2017-09-07
US9954897B2 true US9954897B2 (en) 2018-04-24

Family

ID=59722895

Family Applications (1)

Application Number Title Priority Date Filing Date
US15/057,234 Active 2036-06-25 US9954897B2 (en) 2016-03-01 2016-03-01 Methods and systems providing cyber security

Country Status (1)

Country Link
US (1) US9954897B2 (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110324332A (en) * 2019-06-28 2019-10-11 重庆大学 A kind of method of controlling security for micro-capacitance sensor under network attack

Families Citing this family (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11340603B2 (en) 2019-04-11 2022-05-24 Raytheon Company Behavior monitoring using convolutional data modeling
US11436537B2 (en) 2018-03-09 2022-09-06 Raytheon Company Machine learning technique selection and improvement
US11321462B2 (en) 2018-04-10 2022-05-03 Raytheon Company Device behavior anomaly detection
US11507847B2 (en) 2019-07-25 2022-11-22 Raytheon Company Gene expression programming
WO2019199769A1 (en) * 2018-04-10 2019-10-17 Raytheon Company Cyber chaff using spatial voting
WO2019199777A1 (en) 2018-04-10 2019-10-17 Raytheon Company Encryption using spatial voting
CN108769062B (en) * 2018-06-26 2020-12-29 国网福建省电力有限公司 A defense method for multi-stage network attack of power cyber-physical system
US10937465B2 (en) 2019-02-21 2021-03-02 Raytheon Company Anomaly detection with reduced memory overhead
US11341235B2 (en) 2019-02-21 2022-05-24 Raytheon Company Anomaly detection with adaptive auto grouping
SG11202010204TA (en) * 2019-12-12 2020-11-27 Alipay Hangzhou Inf Tech Co Ltd Determining action selection policies of an execution device
CN111464501A (en) * 2020-03-09 2020-07-28 南京邮电大学 Data service-oriented adaptive intrusion response gaming method and system thereof
CN111988415B (en) * 2020-08-26 2021-04-02 绍兴文理学院 Mobile sensing equipment calculation task safety unloading method based on fuzzy game
CN112839042B (en) * 2021-01-08 2021-11-23 北京虹信万达科技有限公司 Situation awareness system based on information system network security
CN115102166B (en) * 2022-07-27 2025-04-08 南京邮电大学 Active power distribution network dynamic defense performance optimization method based on game theory
CN115348064B (en) * 2022-07-28 2023-09-26 南京邮电大学 Design method of distribution network defense strategy based on dynamic game under network attack
CN115811730B (en) * 2022-11-25 2024-04-19 河海大学 Game-based source node location privacy protection method in underwater acoustic sensor networks
CN117332684B (en) * 2023-09-25 2024-04-26 同济大学 An optimal capture method for multi-spacecraft pursuit-escape game based on reinforcement learning

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050166072A1 (en) * 2002-12-31 2005-07-28 Converse Vikki K. Method and system for wireless morphing honeypot
US20080289040A1 (en) * 2004-04-27 2008-11-20 Ravishankar Ganesh Ithal Source/destination operating system type-based IDS virtualization
US20100042418A1 (en) * 2008-08-12 2010-02-18 Kjell Olsson Technical tools for complex information
US8271345B1 (en) * 2008-12-22 2012-09-18 Auctionomics Inc. Systems and method for incorporating bidder budgets in multi-item auctions
US20130096980A1 (en) * 2011-10-18 2013-04-18 Mcafee, Inc. User-defined countermeasures
US20150018060A1 (en) * 2013-07-11 2015-01-15 International Business Machines Corporation System and method for decision making in strategic environments
US20150128246A1 (en) * 2013-11-07 2015-05-07 Attivo Networks Inc. Methods and apparatus for redirecting attacks on a network
US20160308898A1 (en) * 2015-04-20 2016-10-20 Phirelight Security Solutions Inc. Systems and methods for tracking, analyzing and mitigating security threats in networks via a network traffic analysis platform

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050166072A1 (en) * 2002-12-31 2005-07-28 Converse Vikki K. Method and system for wireless morphing honeypot
US20080289040A1 (en) * 2004-04-27 2008-11-20 Ravishankar Ganesh Ithal Source/destination operating system type-based IDS virtualization
US20100042418A1 (en) * 2008-08-12 2010-02-18 Kjell Olsson Technical tools for complex information
US8271345B1 (en) * 2008-12-22 2012-09-18 Auctionomics Inc. Systems and method for incorporating bidder budgets in multi-item auctions
US20130096980A1 (en) * 2011-10-18 2013-04-18 Mcafee, Inc. User-defined countermeasures
US20150018060A1 (en) * 2013-07-11 2015-01-15 International Business Machines Corporation System and method for decision making in strategic environments
US20150128246A1 (en) * 2013-11-07 2015-05-07 Attivo Networks Inc. Methods and apparatus for redirecting attacks on a network
US20160308898A1 (en) * 2015-04-20 2016-10-20 Phirelight Security Solutions Inc. Systems and methods for tracking, analyzing and mitigating security threats in networks via a network traffic analysis platform

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
Shen et al., Game Theoretic Solutions to Cyber Attack and Network Defense problems, 2007. *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110324332A (en) * 2019-06-28 2019-10-11 重庆大学 A kind of method of controlling security for micro-capacitance sensor under network attack

Also Published As

Publication number Publication date
US20170257396A1 (en) 2017-09-07

Similar Documents

Publication Publication Date Title
US9954897B2 (en) Methods and systems providing cyber security
CN110191083B (en) Security defense method, device and electronic device for advanced persistent threats
Carroll et al. A game theoretic investigation of deception in network security
RU2726394C1 (en) Method and device for predicting optimal solutions of attack and defence in scenario of military conflict
Pavur et al. The cyber-ASAT: on the impact of cyber weapons in outer space
CN108701260B (en) System and method for assisting decision making
Govindaraj et al. An intrusion detection and prevention system for ddos attacks using a 2-player bayesian game theoretic approach
Kott Challenges and characteristics of intelligent autonomy for internet of battle things in highly adversarial environments
Inglesant et al. Responsible innovation in quantum technologies applied to defence and national security
Lucas The stochastic versus deterministic argument for combat simulations: Tales of when the average won't do
Huang et al. Exposing Spoofing Attack on Flocking‐Based Unmanned Aerial Vehicle Cluster: A Threat to Swarm Intelligence
Son et al. Introduction to MITRE ATT&CK: concepts and use cases
Holland et al. Using agents to model the kill chain of the ballistic missile defense system
Xi et al. A Hypergame‐Based Defense Strategy Toward Cyber Deception in Internet of Battlefield Things (IoBT)
Luo et al. A fictitious play‐based response strategy for multistage intrusion defense systems
Dekker Simulating network robustness: two perspectives on reality
CN115310257B (en) Situation estimation method and device based on artificial potential field
Ward et al. An empirical method for benchmarking multi-robot patrol strategies in adversarial environments
Jia et al. An operational effectiveness evaluation method of the swarming UAVs air combat system
Gutierrez et al. Generating effective patrol strategies to enhance US border security
Giachetti System of systems capability needs analysis via a stochastic network model
Green The fifth masquerade: An integration experiment of military deception theory and the emergent cyber domain
Medhi et al. Byzantine Resilient Reinforcement Learning for Multi-Agent UAV Systems
Green et al. Evaluating a Planning Product for Active Cyberdefense and Cyberdeception
Kanwer Comprehensive study of implementation of machine learning in military

Legal Events

Date Code Title Description
AS Assignment

Owner name: INTELLIGENT FUSION TECHNOLOGY, INC, MARYLAND

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:SHEN, DAN;CHEN, GENSHE;PHAM, KHANH D.;AND OTHERS;SIGNING DATES FROM 20160228 TO 20160229;REEL/FRAME:037911/0389

AS Assignment

Owner name: INTELLIGENT FUSION TECHNOLOGY, INC., MARYLAND

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:SHEN, DAN;CHEN, GENSHE;PHAM, KHANH D.;AND OTHERS;SIGNING DATES FROM 20160228 TO 20160229;REEL/FRAME:044739/0204

STCF Information on status: patent grant

Free format text: PATENTED CASE

MAFP Maintenance fee payment

Free format text: PAYMENT OF MAINTENANCE FEE, 4TH YR, SMALL ENTITY (ORIGINAL EVENT CODE: M2551); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY

Year of fee payment: 4

AS Assignment

Owner name: INTELLIGENT FUSION TECHNOLOGY, INC, MARYLAND

Free format text: CORRECTIVE ASSIGNMENT TO CORRECT THE THE APPLICATION NUMBER PREVIOUSLY RECORDED AT REEL: 37911 FRAME: 389. ASSIGNOR(S) HEREBY CONFIRMS THE ASSIGNMENT;ASSIGNORS:SHEN, DAN;CHEN, GENSHE;PHAM, KHANH D.;AND OTHERS;SIGNING DATES FROM 20160228 TO 20160229;REEL/FRAME:070150/0106